[mercora]

i don't think that is necessarily the case but instead i believe in the near future the differences between container sandboxes and virtual machines might be less clear.

I imagine CPU and memory namespaces coming implemented on hardware isolation features like VT-d io-mmus and alike thus making virtual machines integrated into some sandboxing feature.